CVE-2026-75542

Received Received - Intake

Incorrect Authorization in HexPM OAuth Token Endpoint

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: EEF

Description

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires. This issue affects hex.pm: from 2025-10-18 before 2026-08-24.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-75542

EUVD

EUVD-2026-65119

Affected Vendors & Products

Vendor	Product	Version / Range
hexpm	hexpm	From 2025-10-18 (inc) to 2026-08-24 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Authorization issue in the OAuth token endpoint of hexpm. An API key with the repositories permission can read private packages from another organization. When exchanging an API key for a token, the system fails to validate the organization name against the key's permissions. This allows unauthorized access to private repositories until the token expires.

Impact Analysis

If you use hexpm and rely on private package repositories, an attacker with a valid API key could access private packages belonging to other organizations. This could lead to data leaks, intellectual property theft, or unauthorized use of proprietary software. The impact lasts until the compromised token expires.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection, such as GDPR's principle of least privilege or HIPAA's safeguards for protected health information. Unauthorized access to private repositories may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the hexpm software to a version released after 2026-08-24 to address the incorrect authorization issue in the OAuth token endpoint. Review API keys with repositories permission to ensure they are not misused to access unauthorized private packages.

Hi! I’m here to help you understand CVE-2026-75542. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70